Skip to content
AndroidForensics

Device & system

build.prop and Android Device Identifiers

Identify an Android device: build.prop and getprop keys, persistent properties, time zone, serial, IMEI, Android ID and factory reset time in bootstat.

Location
/system/build.prop, /vendor/build.prop, /product/etc/build.prop, /data/property/persistent_properties, /data/misc/bootstat/
Android
Proves
The device's manufacturer, model, Android version, security patch level and build fingerprint, its configured time zone and locale, identifiers such as the serial number and per-app Android IDs, and, where present, when it was last factory reset
Timestamps
ro.build.date.utc in Unix seconds; bootstat files record boot and factory reset times (values or file modification times, depending on the file)
Access
Logical (no root): getprop and the build.prop files are readable by the shell user. Bugreport: full property list. Full file system: persistent_properties and bootstat are in device-encrypted /data, so BFU readable by a privileged extraction.
Retention
build.prop changes only with a system update; persistent properties until changed or reset; bootstat files survive until the next factory reset
Collection
adb shell getprop, adb shell cat /system/build.prop, adb bugreport, Full file system extraction

Tools

Compare all tools

What it is

Every Android device describes itself through system properties: key and value pairs such as ro.product.model or ro.build.version.security_patch. Read-only properties (ro.*) are loaded at boot from build.prop files on the system, vendor, product and ODM partitions. Persistent properties (persist.*) are user or system settings that survive reboots and live in /data/property/.

For an examiner, these properties are the first page of any report: they fix the exact build, which decides every path and format on this site, the patch level that decides which extraction methods apply, and the configured time zone that decides how local times convert to UTC. Next to them, a handful of files identify the physical handset and its reset history.

Where it lives

ItemPathNotes
System build properties/system/build.propOn system-as-root devices mounted at /system/build.prop; inside an image of the partition often /system/system/build.prop
Other partitions/vendor/build.prop, /product/etc/build.prop, /odm/etc/build.prop, /system_ext/etc/build.propPartition-specific values
Persistent properties/data/property/persistent_propertiesSingle protobuf file since Android 9; one file per property before
Boot statistics/data/misc/bootstat/Files such as last_boot_time_utc, factory_reset, build_date on many builds
Per-app Android ID/data/system/users/<user>/settings_ssaid.xmlSSAID per app signing key (Android 8+)

What it proves

  • The make, model and product name (ro.product.manufacturer, ro.product.model, ro.product.name), and the build fingerprint that uniquely names the firmware.
  • The Android version, API level and security patch level.
  • The build date (ro.build.date.utc), which bounds when the firmware was installed.
  • The configured time zone (persist.sys.timezone) and locale.
  • The hardware serial number (ro.serialno or ro.boot.serialno), which ties the extraction to the physical device in your exhibit list.
  • On builds that keep it, the time of the last factory reset from /data/misc/bootstat/factory_reset.

Key fields

PropertyExample meaning
ro.build.fingerprintbrand/product/device:15/AP4A.250105.002/12345678:user/release-keys
ro.build.version.release, ro.build.version.sdkAndroid version and API level
ro.build.version.security_patchSecurity patch date
ro.build.display.id, ro.build.version.incrementalOEM build names
ro.product.manufacturer, ro.product.model, ro.product.deviceHardware identity
ro.serialno / ro.boot.serialnoDevice serial
persist.sys.timezoneOlson time zone, for example Europe/Paris
ro.boot.verifiedbootstate, ro.boot.flash.lockedVerified boot colour and bootloader lock state

The IMEI is not a property. Read it from the device's About phone screen, by dialling *#06#, or from the SIM tray label; since Android 10 apps and the shell cannot read it without privileged permission. Record it from the device itself rather than from a dump.

Timestamps

ro.build.date.utc is Unix seconds. Bootstat files hold either a value (for example Unix seconds) or are meaningful by their modification time; interpretation differs by file and build.

adb shell getprop | tee getprop.txt
grep -E 'fingerprint|security_patch|build.date.utc|timezone|serialno|verifiedbootstate' getprop.txt
adb shell 'ls -l --full-time /data/misc/bootstat/' 2>&1   # needs root on most builds

Retention

Build properties change only with an OTA update or a new flash. Persistent properties persist until the setting changes. /data/misc/bootstat/ and all of /data are wiped by a factory reset, which is precisely what makes the factory_reset record meaningful: its time is when the current data partition was born.

Collection

  • Logical: adb shell getprop and adb shell cat /system/build.prop work without root. Photograph Settings > About phone too.
  • Bugreport: the system properties section lists every property.
  • Full file system extraction: persistent_properties, bootstat and settings_ssaid.xml from /data.

Parsing

  • ALEAPP reports build information, the factory reset time and Android IDs when present.
  • blackboxprotobuf or protoc --decode_raw read persistent_properties.
  • Commercial suites summarise these in their device information section.

Investigator tips

  • Record ro.build.fingerprint and the patch level in the acquisition notes of the acquisition guide checklist.
  • A factory reset date after the incident explains an empty phone; pair it with the first install times in installed packages and the account times in accounts databases.
  • ro.boot.verifiedbootstate other than green, or an unlocked bootloader, indicates a modified device: note it before trusting system logs.
  • Use persist.sys.timezone to convert local-time artifacts such as batterystats anchors.

See also